@yizha1 we are blocked by this. Azure sdk for go has limitation on the Refresh Token Client not being exposed on latest sdk. We cannot upgrade to latest stable sdk until this is resolved. We will need to postpone this post GA

@akashsinghal Thanks for sharing this information. This means we need to keep using the current preview SDK, and figure out the upgrade path or other alternatives to solve this issue. We can discuss it further in the community meeting on 8/16/2023.

Move to 1.1

Hi @akashsinghal , for new contributor to ramp up on this. Would you be able to include doc and src code links for the impact code path/user scenario. thanks!

I believe the impacted code path are in azidentity and azureworkloadidentity. @akashsinghal to confirm if this currently cli or only the k8s scenario

@susanshi this issue is tracking specifically the ACR SDK which is used only by oras workload identity auth provider. This issue is blocked. New versions of SDK do not expose only receiving refresh token for AAD token which is what ORAS requires as input for credential. Until a new version exposes a refresh client, we cannot proceed from Ratify side

oras-project/oras-go#476